Model Based Development (MBD) is a concept of software development in which models are developed as work products at every stage in the development life cycle. Models are concise and understandable abstractions that capture critical decisions pertaining to a development task. Models have semantics derived from the concepts and theories of a particular technical domain. Models supersede text and code as primary work products in Model Based Development, and most development activities are carried out by processing models with as much automation as possible.
Model Based Development is known to improve the quality of the product being developed. Formal models of design are used to prove that the product design is correct with respect to the product's functional requirements, thereby reducing defect leakage from the design. Automatic code and test case generation helps to reduce both coding errors and total development time.
It is well known that formal verification techniques like theorem proving and model checking reduce design defects by determining whether a design meets its functional requirements. The presence of formal models in Model Based Development permits analysis of a design using formal verification. Both Model Based Development and formal verification put emphasis on detecting design errors (high leakage rate) rather than implementation errors (low leakage rate).
The DO-178B standard produced by Radio Technical Commission for Aeronautics, Inc. defines guidelines for the development of avionics software and is the accepted means of certifying all new avionics software. However, the DO-178B standard is obsolete with respect to the Model Based Development process, but recognizes formal methods as a way to prevent and eliminate requirements errors, design errors, and code errors throughout the development life cycle. The need for formal verification of models during the design stage is also validated by its successful use in various industrial level examples.
In spite of all of the above advantages, formal verification has not been successfully integrated into many development processes. The main issues arising from such successful integration are related to making formal verification tools easy to use by the system engineers. Formal verification tools typically do not support standard design modeling notations, but they do have their own notations related to the theories of the tool. The extra effort to learn the notations to use these tools is usually not welcome because this effort causes delays in product development. Consequently, there is a need to automate the formal verification process as much as possible.
One possible step towards automation is to make formal verification tools available in notations that system engineers typically use. Model Based Development tools from Mathworks like Simulink, Stateflow, etc. are extensively used by the assignee of the present application for development. It would be desirable for these notations to automatically link to suitable model checking tools. The model can then be formally verified to satisfy its functional requirements automatically using a model checker such as the NuSMV model checker, thereby reducing defect leakage from the design.
As an example, a translator, that is described below in the detailed description and that translates from a Simulink model to a NuSMV model that can then be checked by a NuSMV model checker, can be devised. NuSMV is a symbolic model checker jointly developed by ITC-IRST, CMU, University of Genova, and University of Trento. This translator would then be usable to take a Simulink model as an input and to generate an equivalent NuSMV model.
Such a translator would support all of the basic blocks of the Simulink block library that constitute a finite state subset of Simulink, i.e., any model obtained by putting together these blocks is merely a finite state machine. The NuSMV model generated by the translator would then be formally verified using the NuSMV model checker. The NuSMV model checker supports specification of functional requirements as formulas of the formal language temporal logic. The logic is capable of expressing typical functional requirements like those of safety properties, avoiding deadlocks, race conditions etc.
Various mechanisms and tools have been developed for formally verifying Simulink and Stateflow models. A tool denoted sf2SMV is a research tool developed at CMU for converting Stateflow models into the model checking tool SMV, which is similar to NuSMV. However, Stateflow constitutes just one toolbox in Simulink. Also, it would be better if a translator would support Simulink blocks in addition to Stateflow blocks.
Checkmate is another research tool developed to translate Simulink models into hybrid automata notation so that models capturing both discrete and continuous properties can be verified. Checkmate performs verification of Simulink models using finite state approximations of hybrid automata where the verification need not complete due to bad approximations. By contrast, verification of Simulink models by the NuSMV model checker can be performed against temporal logic properties such that the NuSMV model checker substantially always terminates with a yes/no answer.
The SCADE design verifier that is combined with the SCADE-Simulink gateway is available from Esterel Technologies, is a part of SCADE-Suite™, and can be used to formally verify Simulink models by translating them into the notation of SCADE. However, SCADE provides support for verification of requirements specified as safety properties only and not arbitrary temporal logic formulas (that are more expressive) as is possible using NuSMV.
Embedded Validator from OSC Embedded Systems AG provides a mechanism for formally verifying Simulink and Stateflow models using the VIS and Prover Plug-in verification engines in the background. However, the requirements that the model can be verified against are fixed a priori, whereas NuSMV supports verification of arbitrary temporal logic based functional requirements.
A proposal for model based safety analysis has been offered to verify the safety properties of Simulink models and uses a two-step translation. In the first step, Simulink models are translated into Lustre, which is the textual notation of SCADE that is used to specify models. In the second step, the Lustre model is translated into NuSMV. However, a direct translation from Simulink models to NuSMV is desirable and would reduce the verification effort and time.